With the previous setup, browsers were free to use a local cache for any length of time they pleased: we didn't set an 'Expires' header (or max-age directive), and Cache-Control just said "you're free to cache this". Therefore be more explicit: we don't mind if browsers cache things, but they MUST revalidate everything on every request. GitHub-Pull-Request: https://github.com/syncthing/syncthing/pull/3221